How to prevent ransomware in a small business: seven practical steps

What is ransomware?

Ransomware is malicious software that locks your files or systems, or steals them, and then demands payment. Attackers often encrypt data so you cannot open it, and may threaten to publish sensitive information if you do not pay.

For a small business, the practical effect is simple: you cannot work until systems are recovered.

Why are small businesses targeted?

Attackers look for businesses where protection is uneven and recovery is hard. Small and medium businesses often have limited in-house IT, ageing systems and backups that have never been tested.

You do not need to be a large or well-known organisation to be a target. Many attacks are automated and look for any weakness they can find.

How does ransomware usually get in?

Most attacks start with a small number of common routes:

• Phishing: emails or texts that trick someone into sharing a password or opening a link.
• Malicious attachments: files that install malware when opened.
• Compromised websites: pages that download malware without the visitor noticing.
• Unpatched software: known weaknesses in servers, firewalls or applications that have not been updated.
• Stolen or weak passwords: used to log in to remote access or email directly.

What can an attack cost your business?

The ransom is only part of it. Costs include downtime, lost work, recovery effort, and damage to the trust of clients who rely on you.

If personal information is affected, you may also have obligations under Australian privacy law, including notifying people in some cases. Take advice early if you think data has been taken.

Paying does not ensure you will get your data back, and it may mark you as a business willing to pay. Authorities generally advise against it.

Step 1: Do you have a tested recovery plan?

A disaster recovery plan sets out how you restore systems, in what order, and who does what. Two ideas help you set targets: how much downtime you can tolerate, and how much recent data you can afford to lose.

Plan for people as well as systems. Know how staff will work if the office is unavailable, and how you will contact them. Our step-by-step disaster recovery plan guide covers this in more detail.

Step 2: Are your backups separate and tested?

Backups are the single most useful protection against ransomware, but only if they survive the attack. A copy that is permanently connected to your network can be encrypted along with everything else.

A widely used approach is the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept offsite or offline. Most importantly, test restores regularly so you know the backups work.

Read more in why data backups are key to protecting your data.

Step 3: Is multi-factor authentication switched on?

Multi-factor authentication asks for a second proof of identity, such as a code from an authenticator app or a security key, as well as a password. It makes stolen passwords far less useful.

Turn it on first for email, remote access, cloud services and administrator accounts. Where you can, prefer an authenticator app or security key over text messages.

Step 4: Are systems patched promptly?

Attackers actively look for known weaknesses in software that has not been updated. The longer a known flaw stays open, the more likely it is to be used.

Set up automatic updates for operating systems, browsers and applications, and make sure firewalls, servers and network equipment are included. Retire software that no longer receives updates.

Step 5: Do you use strong, unique passwords?

Weak or reused passwords let attackers log in without any malware at all. Once inside, they can disable protection and prepare an attack.

Use a password manager so staff can use long, unique passwords without remembering them. Our guide to managing your passwords like a pro explains how.

Step 6: Do you have a ransomware response plan?

A response plan is a short document that tells people what to do in the first hour. It should cover:

1. Who to call first, and who is in charge.
2. How to isolate affected devices from the network quickly.
3. Who speaks to staff, clients and any regulators.
4. Where the contact list and recovery steps are kept if systems are down.
5. When to contact your IT provider, your insurer and legal advisers.

Print a copy. If your files are locked, you will not be able to read a plan stored on the same system.

Step 7: Are staff trained to spot attacks?

Staff are both your first line of defence and a common way in. Training works best when it is short, regular and realistic, rather than an annual compliance exercise.

Cover phishing emails, fake invoices, text message scams and phone calls that pressure people to act quickly. Make it easy and safe to report a mistake straight away, because speed matters.

What should you do if an attack happens?

Act quickly and calmly. Disconnect affected devices from the network, call your IT provider, and follow your response plan.

Tell your insurer if you have cyber cover, and take legal advice if personal information may be involved. Do not delete anything, because logs and files can help investigators work out what happened.

What should you do first?

If you cannot do everything at once, start with these three: tested offsite backups, multi-factor authentication, and prompt patching. They address the most common ways ransomware succeeds.

Then add a written response plan and regular training. The Australian Cyber Security Centre's Essential Eight includes several of these controls, and Fast Response IT helps businesses work towards it in stages.

How can Fast Response IT help?

Fast Response IT provides cyber security and backup and disaster recovery for small and medium businesses in Sydney, including patching, access controls, monitoring and recovery planning.

To find out where your business is most exposed, take the cyber risk check.